Senior Info Sec Risk Auditor - Remote
About The Position
As a Senior Information Security Risk Auditor within Optum Serve, you will help ensure cybersecurity compliance with internal policies, federal regulations, and contractual security obligations. You will manage IT cybersecurity assessments conducted by third-party assessment organizations to meet contract requirements. You will also perform internal cybersecurity assessments, testing, and artifact collection to evaluate compliance, identify control gaps, facilitate and monitor remediation, and validate completed remediation. The role requires sound assessment judgment and independent initiative. The role is remote within the United States. Employees hired in the Minneapolis or Washington, D.C. area must work in the office at least four days per week. Remote employees must follow UnitedHealth Group’s Telecommuter Policy.
Requirements
- Undergraduate degree related to computer science, information technology, or cybersecurity, or equivalent relevant work experience.
- At least 4 years of relevant experience working with or assessing enterprise IT and cybersecurity environments, including cybersecurity assessments, IT audit, information security risk, compliance, or related assurance.
- At least 3 years of experience applying federal cybersecurity standards such as NIST SP 800-53 and NIST SP 800-171.
- Demonstrated experience independently planning and executing IT or cybersecurity assessments and managing them through completion.
- Working knowledge of cybersecurity control domains, including identity and access management, privileged access, vulnerability management, configuration management, logging and monitoring, incident response, change management, network security, system development, backup and recovery, and third-party risk management.
- Solid written and verbal communication skills, including the ability to communicate effectively with technical and non-technical audiences.
Nice To Haves
- Professional certification such as CISA, CISSP, CRISC, CISM, or another relevant security, risk, or audit certification.
- Experience coordinating external cybersecurity assessments or working directly with third-party assessors.
- Ability to initiate tasks and work independently.
- Ability to evaluate and navigate complex technical challenges while balancing competing priorities and stakeholder needs.
- Ability to build and maintain rapport with cross-functional leaders, peers, subordinates, internal company contacts, and external stakeholders.
Responsibilities
- Coordinate and manage third-party control assessment engagements, including scope, schedules, stakeholder participation, evidence requests, and issue resolution.
- Prepare control owners and subject-matter experts for assessor walkthroughs, interviews, and technical discussions.
- Plan and execute risk-based internal assessments of cybersecurity and IT controls, evaluating design, implementation, and operating effectiveness against internal policies, contractual obligations, federal requirements, and established control criteria.
- Support internal security initiatives by managing stakeholder expectations and collecting and reviewing artifacts for completeness, consistency, and alignment with control requirements.
- Identify, analyze, and communicate cybersecurity control deficiencies and evaluate associated risks and potential impacts.
- Coordinate corrective-action tracking with control owners, escalate overdue or unresolved issues, and validate remediation before closure.
- Communicate professionally with technical teams, business leaders, end users, internal company contacts, and external stakeholders through multiple channels.
Benefits
- Comprehensive benefits package, subject to eligibility requirements.
- Incentive and recognition programs.
- Equity stock purchase program.
- 401(k) contribution.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
